Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): replace dependency eslint-plugin-node with eslint-plugin-n 14.0.0 #368

Merged
merged 2 commits into from
Mar 25, 2024

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Mar 21, 2024

Mend Renovate

This PR contains the following updates:

Package Type Update Change
eslint-plugin-node devDependencies replacement 11.1.0 -> 14.0.0

This is a special PR that replaces eslint-plugin-node with the community suggested minimal stable replacement version.


Configuration

📅 Schedule: Branch creation - "before 4am on Monday,before 4am on Thursday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate renovate bot added the automerge Enable Kodiak auto-merge label Mar 21, 2024
@renovate renovate bot requested a review from JoeKarow as a code owner March 21, 2024 02:23
@renovate renovate bot added the dependencies Change in project dependencies. label Mar 21, 2024
Copy link

vercel bot commented Mar 21, 2024

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
transmascfutures ✅ Ready (Inspect) Visit Preview 💬 Add feedback Mar 25, 2024 8:06pm

Copy link

github-actions bot commented Mar 21, 2024

📦 Next.js Bundle Analysis for @weareinreach/glaad

This analysis was generated by the Next.js Bundle Analysis action. 🤖

This PR introduced no changes to the JavaScript bundle! 🙌

Copy link

socket-security bot commented Mar 21, 2024

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/@storybook/nextjs@7.6.17 Transitive: environment, eval, filesystem, network, shell, unsafe +276 28.5 MB shilman
npm/@storybook/react@7.6.17 Transitive: environment, eval, filesystem, network, shell, unsafe +79 14.5 MB shilman
npm/@storybook/testing-library@0.2.2 Transitive: environment, eval +32 4.81 MB yannbf
npm/@tabler/icons-react@2.47.0 None +1 194 MB codecalm
npm/@tanstack/react-query-devtools@4.36.1 environment +1 1.86 MB tannerlinsley
npm/@tanstack/react-query@4.36.1 environment +1 3.6 MB tannerlinsley
npm/@tomfreudenberg/next-auth-mock@0.5.6 None 0 34 kB tom-freudenberg
npm/@trpc/client@10.45.2 network 0 253 kB katt
npm/@trpc/next@10.45.2 None 0 111 kB katt
npm/@trpc/react-query@10.45.2 None 0 285 kB katt
npm/@trpc/server@10.45.2 environment 0 713 kB katt
npm/@types/luxon@3.4.2 None 0 120 kB types
npm/@types/node@20.11.30 None 0 2.01 MB types
npm/@types/prettier@2.7.3 None 0 49.8 kB types
npm/@types/react-dom@18.2.22 None 0 34 kB types
npm/@types/umami@0.1.5 None 0 3.14 kB types
npm/@types/ws@8.5.10 None 0 21.7 kB types
npm/@typescript-eslint/eslint-plugin@7.3.1 Transitive: environment, filesystem +23 6.51 MB jameshenry
npm/@vercel/analytics@1.2.2 None 0 190 kB vercel-release-bot
npm/@vercel/speed-insights@1.0.10 None 0 272 kB vercel-release-bot
npm/boxen@7.1.1 None +4 93.9 kB sindresorhus
npm/chromatic@11.2.0 None 0 4.3 MB ghengeveld
npm/dotenv-cli@7.4.1 Transitive: environment, filesystem, shell +2 44.7 kB entropitor
npm/dotenv@16.4.5 environment, filesystem 0 79.1 kB motdotla
npm/embla-carousel-auto-height@7.1.0 None +1 407 kB davidjerleke
npm/embla-carousel-react@7.1.0 None +1 409 kB davidjerleke
npm/eslint-config-next@14.1.4 unsafe Transitive: environment, eval, filesystem, shell +75 11.4 MB vercel-release-bot
npm/eslint-formatter-github@1.1.4 environment Transitive: filesystem, network, shell +36 6.2 MB alisowski
npm/eslint-plugin-codegen@0.28.0 environment, filesystem, shell Transitive: unsafe +59 17.9 MB mmkale
npm/eslint-plugin-i18next@6.0.3 None 0 67.3 kB edvardchen
npm/eslint-plugin-n@14.0.0 filesystem +6 1.25 MB weiran.zsd
npm/eslint-plugin-react@7.34.1 filesystem Transitive: eval +39 4.15 MB ljharb
npm/eslint-plugin-storybook@0.8.0 Transitive: environment, filesystem +25 2.95 MB yannbf
npm/eslint-plugin-turbo@1.13.0 environment, eval, filesystem, shell +1 490 kB turbobot
npm/eslint@8.57.0 environment, filesystem Transitive: eval, shell, unsafe +41 8.93 MB eslintbot
npm/husky@9.0.11 environment, filesystem, shell 0 3.61 kB typicode
npm/i18next-browser-languagedetector@7.2.0 None +1 350 kB adrai
npm/i18next-http-backend@2.5.0 network +1 201 kB adrai
npm/i18next@23.10.1 None +1 897 kB adrai

🚮 Removed packages: npm/prettier@3.2.5, npm/react-dom@18.2.0, npm/react@18.2.0, npm/typescript@5.4.3, npm/zod@3.22.4

View full report↗︎

…-n 14.0.0

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate renovate bot force-pushed the renovate/eslint-plugin-node-replacement branch from 60e511a to df9866c Compare March 25, 2024 20:01
Copy link

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert Package NoteSource
Install scripts npm/@vercel/speed-insights@1.0.10
  • Install script: postinstall
  • Source: node scripts/postinstall.mjs
Install scripts npm/@swc/core@1.4.8
  • Install script: postinstall
  • Source: node postinstall.js
Install scripts npm/core-js-pure@3.36.1
  • Install script: postinstall
  • Source: node -e "try{require('./postinstall')}catch(e){}"
Install scripts npm/core-js@3.36.1
  • Install script: postinstall
  • Source: node -e "try{require('./postinstall')}catch(e){}"
  • orphan: npm/core-js@3.36.1

View full report↗︎

Next steps

What is an install script?

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

  • @SocketSecurity ignore npm/@vercel/speed-insights@1.0.10
  • @SocketSecurity ignore npm/@swc/core@1.4.8
  • @SocketSecurity ignore npm/core-js-pure@3.36.1
  • @SocketSecurity ignore npm/core-js@3.36.1

@kodiakhq kodiakhq bot merged commit aaf3c4b into dev Mar 25, 2024
11 of 12 checks passed
@kodiakhq kodiakhq bot deleted the renovate/eslint-plugin-node-replacement branch March 25, 2024 20:04
This pull request was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
automerge Enable Kodiak auto-merge dependencies Change in project dependencies.
Development

Successfully merging this pull request may close these issues.

1 participant